National benefit fund moves member services to native Azure

The project

A national benefit fund serving thousands of entertainment industry workers had outgrown the systems behind its member services. Benefits administration, claims processing, and member communications all ran on infrastructure that couldn’t deliver the security, performance, and scalability the organization needed.

The fund engaged Winmill to design and build a cloud-native architecture on Azure with one clear ground rule: every architectural element would use native Azure components, with no third-party dependencies that add complexity, licensing costs, or maintenance overhead.

The challenges

Several requirements shaped the migration:

• Security and compliance. The fund handles sensitive member data, healthcare information, and financial records, so the architecture needed defense-in-depth security and strict access controls that meet regulatory compliance standards. Traditional on-premises security models wouldn’t translate directly to the cloud.
• Variable demand. Member traffic spikes during enrollment periods and claims submissions. The application had to scale automatically through the peaks without paying for idle capacity the rest of the year.
• Automation from day one. The fund wanted continuous integration and continuous deployment through Azure DevOps without manual intervention, using managed services and serverless technologies wherever they fit to keep long-term maintenance costs down.
• A reusable framework. Beyond the immediate migration, the fund wanted a standardized architectural template that could serve as the foundation for future enterprise projects.

The solution

Winmill designed and implemented a cloud-native architecture that uses Azure’s full platform capabilities while meeting the fund’s requirements for security, performance, and maintainability.

• Microservices on .NET Core. Small, independently scalable services deployed to serverless hosts wherever possible, eliminating operating system maintenance for services that don’t need a persistent runtime. Individual services scale on demand, a failure in one service doesn’t cascade to others, and updates ship to one service without touching the rest.
• Secure service communication. Services communicate through Azure Service Bus, a managed messaging platform, so inter-service traffic stays encrypted and auditable with no queuing infrastructure to run. A secure Web API with OAuth 2.0 authentication and role-based access controls supports the front end.
• Serverless front end. The web UI is a static application hosted in Azure Blob Storage and delivered through Azure CDN, keeping load times fast for members everywhere while minimizing hosting costs.
• Native CI/CD. Back-end services run on Azure Web Apps and Azure Functions, integrating directly with Azure DevOps build and release pipelines.
• Infrastructure as code. The entire architecture is captured in Azure Resource Manager templates, giving the fund repeatable deployments across environments and the reusable framework it asked for.
• Security-first design. Azure Application Gateway restricts traffic to trusted Azure components and adds web application firewall protection against common threats.

The results

The application launched on schedule in Azure with zero data loss and no service interruptions, and members gained better access to benefits information and services. The fund also achieved:

• Lower infrastructure costs. The serverless and microservices architecture proved less expensive than traditional server-based hosting, and automatic scaling means the fund only pays for the resources it actually consumes.
• A stronger security posture. The cloud-native design implements defense-in-depth security that meets the fund’s compliance requirements while simplifying day-to-day security management through Azure’s managed services.
• Better performance and reliability. The application has consistently exceeded its performance and reliability SLAs, with Azure CDN keeping load times fast across regions and automatic failover maintaining availability.
• Faster development. Native DevOps integration enabled continuous deployment, so the team ships features and fixes quickly while automated testing maintains quality.
• An organizational standard. The architecture worked so well that the fund adopted it as the standard Azure framework for all new enterprise projects.

“This implementation was so successful that it is being used as the standard Azure cloud architecture for all new enterprise level projects at this organization.”

Benefit fund technology leadership